Problems Monitoring Control Measures to Reduce Risk

An SMS provides management with a framework to facilitate decision-making and to dynamically shape the operating environment. Continuous improvement is a core element of every mature SMS.

Continuously monitoring environments in which your employees work remains crucial to optimal performance in all aspects of your organization's business, including safety.

As SMS skills are learned and practiced, your safety culture naturally matures and operational risk is reduced. Hopefully, these SMS skills become ingrained within your entire organization.

Monitor Effectiveness of Risk Controls

One important characteristic of safe organizations is the adoption of processes that monitor the operating environment to ensure the effectiveness of risk controls and to alert management of emerging hazards.

Based on information learned from continuous monitoring, your managers can adjust operating parameters to reduce risk. However, there are problems faced by many organizations. If you are a safety professional, you are most certainly aware of these challenges. How well do you respond to these questions:

• How can we continuously sustainably monitor controls?
• How can we easily communicate to management that risk is being adequately controlled?

Definitions of Hazard, Risk and Control Measure

Before we begin, we should get some common definitions out of the way so that there are no misunderstandings. In aviation risk management discussions, it is always important that we speak the same language. Further below, we will go through a simple risk management example, so we need to be crystal clear on our definitions. Let's quickly define:

• hazard;
• risk;
• risk index;
• control measure; and
• "issue."

What Is a Hazard?

"A hazard is any undesirable condition or situation which may cause or contribute to an unsafe event or consequence."

Hazards come in many forms. Hazards are not always physical, tangible objects, such as mountains or birds. Hazards may be political or economic, such as:

• New government policies;
• Government currency actions;
• Regulatory changes;
• Chronic endemic corruption; and
• War declarations.

Hazards by themselves are not harmful. It is your interaction with these hazards that cause concern.

Tip #1: Document your hazards in a hazard register, preferably in a database that is integrated with your hazard reporting and risk management system.

Have You Read

• Difference Between Hazards, Risks & Control Measures in Aviation SMS
• How to Identify Hazards and Assess Risks in Aviation SMS Programs - With Free Resources
• Relationship Between a Hazard and Risk Occurrence in Safety Management

What Is Risk?

Aviation safety professionals recognize that risk is "the combination of predicted severity and likelihood of the potential effect of a hazard." In short, think "probability and severity." A very small percentage of aviation service providers also include "exposure" in their risk index calculations.

What Is a Risk Index?

In your SMS, "Risk Index" refers to the calculated "Likelihood" and "Severity" of an unsafe event or hazard-related consequence. If you are using a risk matrix, you may see character descriptions on your matrix such as:

• 5A
• 5B
• 5C.

The risk index is calculated from your risk matrix based on the intersection of the two variables: likelihood and severity. The purpose of the risk index is to communicate risk to safety management personnel. Other departmental managers may not care about the final risk index calculated results, such as 1A, 1B, or 1C. They are more interested in knowing whether risk is either:

• Acceptable;
• Mitigable; or
• Unacceptable.

Based on evaluated risk, management can act accordingly.

Tip #2: Use ICAO's default 5x5 risk matrix. Don't recreate the wheel. Keep it simple -- otherwise, it won't be sustainable in the long run.

Have You Read

• How to Perform Risk Analysis in Aviation SMS
• How to Control Risk in Aviation SMS Programs
• What Is Risk vs Risk Occurrence in Aviation SMS

What Are Control Measures?

Control measures are your defenses against the realization or escalation of hazards into undesirable consequences. In other words, a control measure is a mitigating action or mechanism that may:

• Detect the manifestation of a hazard;
• Prevent the manifestation of a hazard; or
• Correct or minimize risk from hazard-related consequences.

There are many terms in the industry for control measures. Some people simply call them "controls," while others may add other descriptors, such as:

• Recovery measures;
• Escalation controls; or
• Preventative controls.

In the simplest terms, control measures keep bad things from happening or they help the organization recover from hazard-related consequences. But don't forget that control measures also play the incredibly important role of "detecting undesirable states."

Control measures may be called something different in your organization, such as:

• Risk controls;
• Mitigating measures;
• Corrective measures;
• Recovery measures; or simply
• Controls.

Based on over ten years of empirical evidence, controls, risk controls, and control measures seem to be the most popular terms. I prefer "control measures" simply because the laymen can more easily understand what I'm talking about.

Have You Read

• How to Monitor the Effectiveness of Control Measures
• Proactive Risk Controls vs. Mitigative Risk Controls in Aviation SMS
• What Is a Risk Control in Aviation SMS: Meaning, Purpose, Application

What Is Hierarchy of Control?

"Hierarchy of Control" in aviation SMS (and in other risk management circles) refers to a classification system applied to control measures. The classification is based on control measures' perceived effectiveness. The hierarchy is fundamentally useful to trigger an alert to an observant manager that there may be better solutions to a recurring problem. Alternatively, there may be more effective controls to mitigate risk associated with identified hazards from your Hazard Risk Register. More about this later.

There are five possible attributes to organize control measures according to their ability to mitigate risk. These control types are listed with the most effective control types listed first:

• Elimination - Physically remove the hazard;
• Substitution - Replace the hazard;
• Engineering - Isolate assets from the hazard;
• Administrative - Change the way people and equipment interact with the hazard; and
• PPE - Protect workers with "Personal Protective Equipment."

Tip #3: Classify your control measures according to their hierarchy. It will prove very useful to communicate the effectiveness of your control strategy to upper management.

Tip #4: Hazards, hazard-related consequences, and control measures should be evaluated:

• Periodically;
• Whenever hazards manifest themselves;
• Whenever the operating environment changes; or
• As new hazards are identified.

How Hierarchy of Control Communicates to Management

An aviation operation is constantly interacting with hazards. How can managers remain assured hazards' associated risk is mitigated to as low are reasonably practical (ALARP)?

One effective method is to visually organize your controls according to their classifications in the "hierarchy of controls." For example, for keeping moose off the runway, here is an example of a useful report for managers to visually review their control measures for the wildlife hazard. This chart offers insight into implemented controls' effectiveness and guides as to which controls are most effective.

What Is an Issue in Aviation SMS?

When an undesirable state or consequence appears in your daily operations, it is almost immediately detected and reported by employees interacting with the hazard. The employee may report the undesirable situation to management using paper, email, an in-house reporting system, or commercially available aviation Hazard Reporting Software.

For the sake of this discussion, when the employee submits a report, we'll call this report an issue. If the report was in response to an "event," you will follow your risk management processes to recover from the event and possibly implement additional mitigation controls to prevent recurrence. However, not all reports are in response to an accident or incident.

In the perfect world, all employees are trained in Hazard Identification. When employees identify a hazard, they should also report these hazards regardless of whether your organization has suffered from any hazard-related consequence. In these cases, the issue may be simply a hazard that has been identified, which should trigger a risk assessment and evaluation of existing control measures.

Tip #5: Do not restrict the usage of "Issue" to only identified hazards, accidents, or incidents. They may also include:

• Audit findings and concerns;
• Customer complaints;
• Security concerns;
• FOQA or FDM exceptions requiring further review;
• Flight duty time exceedances; or
• Mission delays.

Any of the above "issues" offers management an opportunity to improve operations as they go through their risk management processes.

An Example Monitoring Control Measures in Real Time

We have the groundwork laid out for us regarding definitions of hazard, risk, control measure, and issue. We will not lose sight of our objective, which is to answer these two questions:

1. How can we continuously monitor controls in a sustainable fashion?
2. How can we easily communicate to management that risk is being controlled?

Let's see an example of how you can monitor your controls and communicate to management based on your implemented control measures. Let's take a very common scenario with airport operations involving a bird strike. We'll identify birds near the airport as a hazard.

Bird strikes occur with aircraft in normal flight or in operations near airports as they are operating in lower altitudes. Even though all bird strikes must be reported to regulatory authorities, there is a very low probability of bird strikes causing significant damage. Modern equipment has been designed to withstand bird strikes with minimal damage to aircraft and aircraft operations.

The most probable hazard-related consequences are:

• Modest aircraft damage; and
• Inconvenienced passengers.

These hazard-related consequences will be used in the severity axis of our risk matrix.

The probability of a bird strike will depend on our location and the season. In my area of operations, I found that between four to eleven bird strikes occur for every 10,000 aircraft movements. I could normalize this data to align with my company operations to achieve a probability score that is easier to work within my risk matrix. Using my SMS database, I learned that bird strikes have been reported more than three times per year at our company.

Based on probability and severity, my risk index has been calculated at 4D. I was momentarily torn between "Negligible" and "Marginal." To quickly determine which element to choose, I remember to consider "worst credible scenarios." So my mind is easily made up to select "Marginal" and now my risk index is justified as 4D.

Classifying Issues Using Hazards From Hazard Register

In the perfect world, your aviation SMS database will have an integrated Hazard Register. Many commercial SMS databases come with an integrated hazard register. When your hazard register is not integrated into your risk management system, the task of associating hazards with reported issues becomes unsustainable in all but very small organizations. Why?

A sustainable process requires simplicity and ease when repeating this process multiple times. If the process is not easy to perform, chances are that you will not continue the process for an extended period of time. This is especially true when you have turnover in your safety department.

When you classify issues using hazards from the hazard register, you will have access to control measures designed to mitigate risk for the associated hazard. This was the most important statement in this blog article.

Having immediate access to control measures related to identified hazards allows managers to review the following items each time an issue is reported:

• Hazards;
• Associated risks; and
• Control measures.

Another important side-note is that this technique allows your organization to continuously monitor hazards, risks and controls as they appear in your daily operations.

In review, this is an abbreviated workflow:

• Issue is reported;
• Safety team analyzes issue;
• Safety team determines the risk index;
• Safety team and other managers associate the issue with identified hazards;
• Risk and control measures are reviewed and evaluated for effectiveness;
• Control measures revised or new controls implemented when warranted.
• Continuous monitoring resumes.

I purposely kept this list short to avoid confusion. To review, the hazard register and associated system description documentation is your "Design." During normal business operations, you are putting your "design" into practice. When problems are detected, you should be:

• Putting out the fire, so to speak to reduce further damage; and
• Review your design and try to improve upon your system design.

Up until now, we have demonstrated an example of how to continuously monitor your control measures for effectiveness. The next question we promised to answer is how to assure management that everything is under control and risk is reduced to ALARP.

How to Communicate to Management Risk Is Controlled

Management understands that accidents happen and that there will never be a guarantee of an accident-free environment. As long as uncertainty exists in this open system (the aviation industry exists in an open system), risk will never be completely mitigated. However, management needs assurances that everything possible is being done to prevent damage, injury, or death.

When an accident or incident occurs, management will reluctantly "take their lumps." In most cases, this means "paying a price" for damage or the implementation of additional controls.

How can you, as a safety professional, assure management that they will not have to continue suffering from the same type of occurrence? They will undoubtedly like to understand what is being done to mitigate the risk. The following report does this nicely.

The above chart was taken from SMS Pro, a commercially available SMS solution designed specifically for the aviation industry. In this case, the report was for a relatively common occurrence in North America: moose on the runway.

Looking at the chart above, we can see the description of the hierarchy of controls on the left and the implemented controls on the right. Control measures are grouped according to how they were classified, such as

• Elimination;
• Substitution;
• Engineering;
• Administrative; and
• PPE.

The above chart is a very powerful communication tool. Management can see their existing controls and mentally evaluate whether implemented controls should be effective to prevent a recurrence. This is how we communicate to management that "everything is under control" and that we should not continually suffer from the same event.

What happens if the same event recurs? Simply repeat the risk management process described above. Review controls and implement additional controls when necessary. Risk management is a continuous process and the process described above helps you fulfill the Safety Assurance pillar's element: "Continuous Improvement of the SMS."

Do you have any techniques to continuously monitor your controls? Please share them in the comments below.

Review Control Measures Tips

1. Document your hazards in a hazard register, preferably in a database that is integrated with your hazard reporting tools.
2. Use the ICAO's default 5x5 risk matrix. Don't recreate the wheel. Keep it simple -- otherwise, it won't be sustainable in the long run.
3. Classify your control measures according to their hierarchy. It will prove very useful to communicate the effectiveness of your control strategy to upper management.
4. Hazards, hazard-related consequences, and control measures should be evaluated:
   • Periodically;
   • Whenever hazards manifest themselves;
   • Whenever the operating environment changes; or
   • As new hazards are identified.
5. Do not restrict the usage of "Issue" to only identified hazards, accidents, or incidents. Examples may also include:
   • Audit findings and concerns;
   • Customer complaints;
   • FOQA or FDM exceptions requiring further review;
   • Flight duty time exceedances; or
   • Mission delays.

Do you need a list of hazards? Looking at an external list of hazards is beneficial for reviewing your hazard register.

SMS Database Software

Commercially available SMS database software with an integrated hazard register allows you to easily manage risk. You save time and money when all your SMS data is in one system.

Last updated August 2024.